diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index c1aa94312..0747724cb 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -29,14 +29,14 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        # Pinned SHA kept in sync with .github/workflows/test.yml (actions/checkout v4).
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        # Pinned SHA kept in sync with .github/workflows/test.yml (actions/checkout v7.0.0).
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           submodules: true
 
       - name: Set up Ruby
-        # Pinned SHA kept in sync with .github/workflows/test.yml (ruby/setup-ruby).
-        uses: ruby/setup-ruby@4a9ddd6f338a97768b8006bf671dfbad383215f4
+        # Pinned SHA kept in sync with .github/workflows/test.yml (ruby/setup-ruby v1.316.0).
+        uses: ruby/setup-ruby@d45b1a4e94b71acab930e56e79c6aa188764e7f9 # v1.316.0
         with:
           ruby-version: 3.3.4
           bundler-cache: true
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 4962ba6b0..654509ddc 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -14,12 +14,12 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       with:
         submodules: true
 
     - name: Set up Ruby
-      uses: ruby/setup-ruby@4a9ddd6f338a97768b8006bf671dfbad383215f4
+      uses: ruby/setup-ruby@d45b1a4e94b71acab930e56e79c6aa188764e7f9 # v1.316.0
       with:
         ruby-version: 3.3.4
         bundler-cache: true